diff options
Diffstat (limited to 'packaging/README.md')
| -rw-r--r-- | packaging/README.md | 50 |
1 files changed, 44 insertions, 6 deletions
diff --git a/packaging/README.md b/packaging/README.md index 6081fc7..8156ca0 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -1,12 +1,13 @@ # MeshBay — Packaging -Four packages, installed under `/opt/<PACKAGE_NAME>/`: +Five packages, installed under `/opt/<PACKAGE_NAME>/`: | Package | RPM spec | DEB control | Description | |---|---|---|---| | `meshbay-common` | `rpm/meshbay-common.spec` | `deb/meshbay-common/` | Shared Python venv + all pip deps | | `meshbay-hub` | `rpm/meshbay-hub.spec` | `deb/meshbay-hub/` | Hub server (FastAPI + PostgreSQL) | | `meshbay-node` | `rpm/meshbay-node.spec` | `deb/meshbay-node/` | Node daemon + local UI | +| `meshbay-cli` | `rpm/meshbay-cli.spec` | `deb/meshbay-cli/` | Command-line client (a member's files from a terminal) + its man page | | `meshbay-client` | `rpm/meshbay-client.spec` | `deb/meshbay-client/` | Electron desktop app | ## Building packages @@ -22,7 +23,7 @@ bash packaging/build/build-packages.sh rpm bash packaging/build/build-packages.sh deb --arm64 ``` -Output: `meshbay-{common,hub,node,client}_<version>_{arch}.{deb,rpm}` in +Output: `meshbay-{common,hub,node,cli,client}_<version>_{arch}.{deb,rpm}` in `/tmp/meshbay-build/out/` (override with `MESHBAY_BUILD_DIR`). The version comes from each package's `pyproject.toml`. @@ -33,12 +34,12 @@ Always install `meshbay-common` first (owns the shared Python venv). ```bash # Ubuntu/Debian sudo dpkg -i meshbay-common_*.deb -sudo dpkg -i meshbay-hub_*.deb meshbay-node_*.deb +sudo dpkg -i meshbay-hub_*.deb meshbay-node_*.deb meshbay-cli_*.deb sudo dpkg -i meshbay-client_*.deb # Fedora sudo rpm -ivh meshbay-common-*.rpm -sudo rpm -ivh meshbay-hub-*.rpm meshbay-node-*.rpm +sudo rpm -ivh meshbay-hub-*.rpm meshbay-node-*.rpm meshbay-cli-*.rpm sudo rpm -ivh meshbay-client-*.rpm ``` @@ -75,8 +76,45 @@ already remembers the hub address — under `videoDecodeProbe`, and ## Architecture meshbay-common owns the shared Python virtual environment at -`/opt/meshbay-common/venv/`. Hub and node install their code into that venv. -The client is a standalone Electron app at `/opt/meshbay-client/`. +`/opt/meshbay-common/venv/`. Hub, node and command-line client install their +code into that venv. The client is a standalone Electron app at +`/opt/meshbay-client/`. + +### meshbay-cli + +The command-line client is its own package, for a desktop that wants it and a +server that does not. `build-common.sh` installs it into the venv last, after +listing what the hub and the node need (`servers-site.txt`, +`servers-bin.txt` in the staging directory); `build-cli.sh` moves whatever that +install added — the client and the packages only it uses (Textual, Rich, +keyring, argon2-cffi, ...) — into `meshbay-cli`, so a server carries none of +them. The list of what moved is installed as `/opt/meshbay-cli/site-packages.list`: +the maintainer scripts compile those files once at install (an unprivileged +user cannot write bytecode into `/opt`, and Textual is slow to compile on every +run) and remove that bytecode before removal. The rpm's `%files` takes the +same entries from a list `build-cli.sh` writes (`meshbay-cli-root.files`), +since they change with every dependency upgrade. + +Its architecture is the machine's, not `all`: argon2-cffi's bindings are +compiled code. Its licence notices are in +`/opt/meshbay-cli/THIRD-PARTY-NOTICES.txt`. + +### Known vulnerabilities + +No lock file pins the Python dependencies: every build installs the newest +releases, so what ships is only known once a build has installed it. That is +where [`audit_deps.py`](audit_deps.py) runs pip-audit — `build-common.sh` on the +venv before stripping it, `build-node-runtime.ps1` on the environment before +PyInstaller freezes it. A known vulnerability stops the build, unless its id is +in [`pip-audit-ignore.txt`](pip-audit-ignore.txt) with why it does not apply. +No network only skips the audit, with a warning. pip-audit itself runs from a +venv of its own (`<staging>/pip-audit`, `packages/meshbay-client/build/_pip-audit` +on Windows), never from the one that ships. + +The man page, `meshbay-cli(1)`, is generated at build time from the client's +own argument parser (`python -m meshbay_cli.manpage`), so it lists the options +the program has; `tests/test_manpage.py` fails when an action or option misses +its section, and checks that troff reads it without a warning. No pip runs at install time — everything is pre-built. |